Telemetry in npm packages.
These packages send usage, machine or identifying details, such as the hostname, email, local paths or command arguments, to their publisher or an analytics service by default. LPM Firewall warns about them, and users can choose to block them with lpm config firewall. These packages are not malware. Packages that send credentials, file contents, prompts or code, or that send data to an unrelated collector, are blocked and listed under Data exfiltration instead.
Packages — page 5
643 packages with an LPM warning, newest scan first. Showing 193–240.
The package is not clearly malicious: its network behavior serves the stated memory feature and connection requires browser approval. However, the automatically installed session-end hook...
The dependency emits raw database results and CRUD query details as runtime usage events without documenting them in the package README or providing an opt-out. No outbound transport was...
The package’s CRUD methods emit raw database results and operation data to process-wide usage listeners without documenting that behavior. No outbound collector or automatic transmission...